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MRS Policy Unit 


MRS Response to ICO: Data sharing code of practice 


Background: About the Market Research Society (MRS) and the research market 


1. The Market Research Society (MRS) is the world’s largest research association with 
5,000 members in over 50 countries. We have a diverse membership of individual 
researchers within agencies, independent consultancies, client-side organisations, the 


public sector and the academic community. 


2. MRS promotes, develops, supports and regulates standards and innovation across 
market, opinion and social research and data analytics. MRS regulates research ethics 
and standards via its Code of Conduct. All individual members and Company Partners 
agree to regulatory compliance via the MRS Code of Conduct and its associated 


disciplinary and complaint mechanisms. 


3. MRS adopted its first self-regulatory Code in 1954 and the latest fully revised version 
of the MRS Code of Conduct came into effect on 1 September 2014'. It is currently 
being revised to reflect legal changes and ensure it reflects emerging technological 
developments. Supported by a suite of guidance documents the Code supports those 
engaged in market and social research in maintaining professional standards and 
reassures the general public that research is carried out in a professional and ethical 
manner. The MRS Code is technology and methodology neutral. It sets out overarching 


ethical principles supported by rules of conduct. 


4. To support the ethical and legal requirements detailed in the MRS Code of conduct, 
there are a number of quality process standards for research. The first quality standard 
was introduced in 1976 and since then the research sector has adopted successive 
process standards to establish the appropriate technical and organisational standards 
for the handling of data in research. To ensure that the sector’s process standards 
remain up to date with technological developments the research ISO standards have 
been expanded to encompass digital and data analytics techniques for research 


purposes. 


5. There are currently three ISO standards for market, opinion and social research: 


1 The MRS code of conduct (2014) : https://www.mrs.org.uk/pdf/mrs%20code%200f%20conduct%202014.pdf 
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i. ISO 20252: 2019: Market, opinion and social research, including insights and 
data analytics - vocabulary and service requirements. 
ii. ISO 26362: 2009: Access panels in market, opinion and social research - 
vocabulary and service requirements.? 
iii. ISO 19731: 2017: Digital analytics and web analyses for purposes of market, 


opinion and social research - vocabulary and service requirements.* 


6. Additionally, a broader range of organisations have signed up for the MRS Fair Data 
mark, which was established in 2012 to complement the self-regulatory arrangements 
under the Code. This data trust mark is designed for use by consumer-facing 
organisations, suppliers of research and data services, and public bodies. It enables 
consumers and citizens to make educated choices about their data and to identify 
organisations which they can safely interact with, knowing that their personal 
information is safe. For organisations that are accredited, it demonstrates a 
commitment to be ethical, transparent and responsible with data. Organisations sign 
up to twelve clear principles that are consumer focused, enabling ease of 
understanding. These twelve core principles of Fair Data work in tandem with the MRS 
Code of Conduct>. The scheme is supplemented by MRS’s Fair Data advisory service 
which includes face-to-face, telephone and e-mail support plus events on best practice, 
best practice guidance and a bespoke audit accreditation process. Fair Data has been 


exported and adopted in Australia, the Netherlands and Singapore. 


Our response 


7. MRS welcomes the opportunity to respond to the ICO Data sharing code of practice 


consultation. Our response will focus on issues most relevant for research. 


Comments on the ICO Data sharing Code of practice August 2019 


8. Market, social and opinion research is the systematic gathering and interpretation of 
information about individuals or organisations using the statistical and analytical 
methods and techniques of the applied social sciences to gain insight or support 


decision making. Research is founded upon the willing co-operation of the public and 


2 Details about ISO 20252: 2019: https://www.iso.org/standard/73671.html 
3 Details about ISO 26362: 2009: https://www.iso.org/standard/43521.html 
t Details about ISO 19731: 2017: https://www.iso.org/standard/66187.html 
° The Fair Data Principles: https://www.fairdata.org.uk/principles/ 


10. 


11. 


12. 


13. 
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business organisations; it depends upon their confidence that it is conducted honestly, 


objectively, without unwelcome intrusion and with harm to participants. 


Research activities are so rooted in ethical considerations that, traditionally researchers 
look at two major elements in relation to participants in their work: doing right, 
following the principles of justice, beneficence through assessing risk; and preventing 


harm, through protecting privacy, being honest, obtaining participant consent. 


This is the background preparation and reasoning that underpins not only the definition 
and undertaking of the research, researchers as practitioners, but also the destination 


of research itself. 


In market and social research, the greater likelihood of data sharing between joint data 
controllers and controller/s and processors for the same purposes is the key issue. 
GDPR and the Data Protection Act 2018 places specific obligations on Controllers and 
Processors, including when data sharing and transfer is being undertaken. It is 
therefore crucial to be sure that those undertaking the activities are correctly 


determining their role and responsibilities. 


The correct identification of roles and responsibilities is particularly challenging in 
research, when depending on the type of research project being undertaken a client 
may be a third party, sole data controller or joint data controller in line with the level 
of autonomy and responsibility the client exercises over the personal data being 
collected. Similarly, a research supplier may be a processor, joint controller or sole 
controller. These are matters which we have raised separately with the ICO, and we 
would welcome more guidance from the ICO on the determination and identification of 
controllers, joint controllers and processors to ensure that responsibilities, particularly 
those relating to data subject rights, are being correctly undertaken by all parties 


involved in personal data sharing. 


These are other points we encourage the ICO to explore and/or expand: 


> MRS welcomes the inclusion of the considerations for data sharing and children. 
Bearing in mind the accountability principle at the heart of the new data 
protection legislation, MRS would like to see the inclusion of special 
considerations regarding data sharing and vulnerable people, focussing on the 


key MRS Code construct of the avoidance of harm. MRS has added a section 
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on protecting vulnerable participants in the new MRS Code which will be 
published in the autumn, to tie onto the existing MRS guideline on researching 
vulnerable individuals. 

> Data sharing in an urgent situation or in an emergency - we would welcome 
some further examples to illustrate scenarios where this might arise, including 
those in the private sector in addition to the examples already provided for the 
public sector. Whilst we appreciate the difficulty of providing detailed guidance 
about international data sharing, we would however welcome such information 
at the earliest opportunity as this remains one of the key areas of concern for 
MRS members and Company Partners as global research, by its nature, results 
in significant amounts of data sharing and transfer. We would particularly 
welcome detailed guidance on how to overcome the current GDPR data sharing 
concerns such as Privacy Shield legal validity (how shall the UK recreate a 
scenario that is already being disputed by its original creator?) and Standard 
Contractual Clauses reliability. Also, specific timelines for UK adequacy 
decisions adoption would be welcomed. . There is a risk of GDPR duplication on 
this topic, which would not be helpful for UK businesses which could end up 
having to comply with infinite number of slightly different regulations across 
Europe and the rest of the world. 

> The guidance provides an overview of the data sharing codes across the public 
sector, including the Digital Economy Act codes and how the two interact. There 
are additional codes such the Research Code of Practice and Accreditation which 
sets out how access to access public authority data for research purposes. The 
relationship between all these data sharing Codes and the ICO data sharing 
code could be clearer; it would be helpful for example to have a separate ICO 
document reconciling all these data sharing codes into one, highlighting where 
there is consistency and if there is inconsistency ICO recommended or required 
approaches to ensure legal adherence. 

> We would welcome further practical guidance for businesses on anonymization 
and pseudonymisation. While the code and relative published material is of 


important help, the practical implication still unclear. 


Further information or clarification on this submission please contact 
and 
This submission is made on behalf of The 


Market Research Society, The Old Trading House, 15 Northburgh Street, London EC1iV 
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OJR. The Market Research Society is a company limited by guarantee, registered in 
England No. 518685. 5 September 2019. 


